Tiny noise, big mistakes: adversarial perturbations induce errors in brain-computer interface spellers

Xiao Zhang; Dongrui Wu; Lieyun Ding; Hanbin Luo; Chin-Teng Lin; Tzyy-Ping Jung; Ricardo Chavarriaga

doi:10.1093/nsr/nwaa233

Tiny noise, big mistakes: adversarial perturbations induce errors in brain-computer interface spellers

Natl Sci Rev. 2020 Sep 10;8(4):nwaa233. doi: 10.1093/nsr/nwaa233. eCollection 2021 Apr.

Authors

Xiao Zhang¹, Dongrui Wu¹, Lieyun Ding², Hanbin Luo², Chin-Teng Lin³, Tzyy-Ping Jung⁴, Ricardo Chavarriaga⁵

Affiliations

¹ Ministry of Education Key Laboratory of Image Processing and Intelligent Control, School of Artificial Intelligence and Automation, Huazhong University of Science and Technology, Wuhan 430074, China.
² School of Civil Engineering and Mechanics, Huazhong University of Science and Technology, Wuhan 430074, China.
³ Centre of Artificial Intelligence, Faculty of Engineering and Information Technology, University of Technology Sydney, Sydney, NSW 2007, Australia.
⁴ Swartz Center for Computational Neuroscience, Institute for Neural Computation, University of California San Diego, La Jolla, CA 92093, USA.
⁵ ZHAW DataLab, Zürich University of Applied Sciences, Winterthur 8401, Switzerland.

Abstract

An electroencephalogram (EEG)-based brain-computer interface (BCI) speller allows a user to input text to a computer by thought. It is particularly useful to severely disabled individuals, e.g. amyotrophic lateral sclerosis patients, who have no other effective means of communication with another person or a computer. Most studies so far focused on making EEG-based BCI spellers faster and more reliable; however, few have considered their security. This study, for the first time, shows that P300 and steady-state visual evoked potential BCI spellers are very vulnerable, i.e. they can be severely attacked by adversarial perturbations, which are too tiny to be noticed when added to EEG signals, but can mislead the spellers to spell anything the attacker wants. The consequence could range from merely user frustration to severe misdiagnosis in clinical applications. We hope our research can attract more attention to the security of EEG-based BCI spellers, and more broadly, EEG-based BCIs, which has received little attention before.

Keywords: BCI spellers; adversarial examples; brain-computer interfaces; electroencephalogram.